What Happens When Your Outsourcing Provider Shuts Down: A Contingency Plan for CPA Firms

When an outsourcing provider shuts down, your firm keeps every legal duty the provider was helping you meet. You still need the client records, you must cut off the provider's access, and you have to decide quickly whether any client data has left your control in a way that triggers breach reporting.

This contingency plan is for US CPA firms whose outsourcing provider shuts down, is sold, or loses the team that served them. It covers the contract terms that decide what you get back, the first 72 hours, the FTC Safeguards Rule duties on access and disposal, IRS record retention, notification rules and the Section 7216 consent questions that come up when the work moves somewhere else.

How an Outsourcing Relationship Ends Without Warning

A planned exit gives you months to prepare, and the steps for that route are in our guide to switching accounting outsourcing providers. An unplanned exit usually takes one of these forms:

• Closure. The provider runs out of cash and stops operating, sometimes with no notice. Its systems may be switched off or sold.
• Acquisition. A larger firm buys the provider, and the data you sent now sits with a company you never assessed.
• Team loss. The senior person on your account leaves and takes the client knowledge with them.

Each one raises the same issues of where your data is, who can still reach it and who will do the work next week. A provider that has gone under can no longer certify anything, so protections need to be in place beforehand.

Contract Terms That Decide What You Get Back

Your contract tells a liquidator or an acquirer what they owe you. Review it while the relationship is healthy and look for these terms. Our accounting outsourcing contract template shows how each one is usually drafted.

• Ownership. All client data and work product belong to your firm, and the provider has no right to sell, license or transfer them as a business asset, including in an insolvency or sale.
• Data return. On termination for any reason, the provider returns all client data in a usable format within a fixed number of days.
• Destruction certificate. After return, the provider deletes every copy, including backups and copies on staff devices, and certifies the deletion in writing.
• Assignment and change of control. The contract cannot pass to a buyer without your written consent, and you may terminate on a change of control.
• Transition support. The provider must cooperate with knowledge transfer for a set period after notice is given by either side.
• Incident notice. The provider must tell you promptly about any security event involving your clients' information.

The FTC expects these clauses to exist. Its Safeguards Rule guide says, "Your contracts must spell out your security expectations, build in ways to monitor your service provider's work, and provide for periodic reassessments of their suitability for the job." Service levels sit in a separate schedule, covered in our post on offshore accounting SLA clauses, and the exit questions to raise before signing are in our list of questions to ask before outsourcing accounting.

The strongest protection is architectural. If the outsourced team works inside your ledgers, tax software and document system through remote access, a shutdown costs you labor while your data stays where it is. If the provider holds the only copy of workpapers on its own servers, a return clause is worth only as much as the provider's ability to honor it.

The First 72 Hours After an Outsourcing Provider Shuts Down

Hours 0 to 4: lock down access. List every credential the provider held: ledger logins, payroll portals, tax software seats, VPN or virtual desktop accounts, shared folders, shared mailboxes and multi-factor devices. Disable each one and record who did it and when. The FTC Safeguards Rule requires access controls that "Authenticate and permit access only to authorized users to protect against the unauthorized acquisition of customer information" and "Limit authorized users' access only to customer information that they need to perform their duties and functions" (16 CFR 314.4(c)(1)). Our data security checklist for offshore accounting partnerships lists the controls to check afterwards.

Hours 4 to 24: confirm what you hold. Log in to every client file and document repository yourself. Note anything that exists only on the provider's systems, such as workpapers, scanned source documents or e-file acknowledgments. Send a written demand for return of that data under the contract, addressed to whoever still answers: the founder, the acquirer or a court-appointed administrator.

Hours 24 to 48: triage deadlines. Sort clients by the next hard deadline. Payroll runs, extension due dates and lender reporting go first; routine monthly bookkeeping can usually wait a week or two.

Hours 48 to 72: decide who does the work. Choose between bringing work back in-house for a period, activating a backup provider, or a mix. If any of the work involves tax returns, check the Section 7216 rules below before a single file goes to a new party.

Recovering Data From a Closed Provider

A closed provider may never send the destruction certificate. Record that gap in your file, along with each request you made and any reply, so you can show later what you did to recover or confirm deletion of the data.

Retention duties do not move with the vendor. The records behind each return must be kept for as long as the IRS can examine that return, whoever prepared it. The IRS page How long should I keep records gives the general rule: "Keep records for 3 years if situations (4), (5), and (6) below do not apply to you." Longer periods apply where income was underreported or a bad debt or worthless securities loss was claimed, and "Keep employment tax records for at least 4 years after the date that the tax becomes due or is paid, whichever is later." For property, "Generally, keep records relating to property until the period of limitations expires for the year in which you dispose of the property." If the provider held the only copy of any of these, rebuilding them from client source documents becomes part of the recovery work.

The Safeguards Rule also sets an outer limit on keeping data you no longer need. Section 314.4(c)(6) requires procedures for "the secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the provision of a product or service to the customer," unless the information "is otherwise required to be retained by law or regulation" or another listed exception applies (16 CFR 314.4(c)(6)). Keep what your retention schedule requires inside your own systems, and treat any copy left at a failed provider as data you can no longer govern.

Breach Rules and Client Notification Duties

A provider closing its doors is a business event, and a closure alone does not trigger FTC notice. The trigger is what happens to the data. Under the Safeguards Rule, a notification event is "acquisition of unencrypted customer information without the authorization of the individual to which the information pertains," and "Unauthorized acquisition will be presumed to include unauthorized access to unencrypted customer information unless you have reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information" (16 CFR 314.2).

If the provider's laptops are sold off with unencrypted client files on them, or former staff keep working logins, you may not be able to produce that evidence.

Section 314.4(j) then sets the deadline. If a notification event "involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event." The notice must include, among other items, "A description of the types of information that were involved," "The number of consumers affected or potentially affected" and "A general description of the notification event" (16 CFR 314.4(j)). An event counts as discovered on the first day it is known to you, and the firm is treated as knowing once it "is known to any person, other than the person committing the breach, who is your employee, officer, or other agent."

The FTC rule sits alongside other reporting routes. The IRS tells preparers to "report client data theft to your local IRS stakeholder liaison," and to "Determine if you need to contact the state attorney general for each state in which you prepare returns" (IRS data theft information for tax professionals). State breach laws set their own thresholds and deadlines for notifying affected individuals, so check each state where your clients live. Our guide to data breach response for tax professionals walks through the IRS reporting steps in detail.

Your written incident response plan under 314.4(h) should already name who decides whether a provider failure is a security event, and who speaks to clients. Our tips on talking to clients about outsourcing help with the wording.

Worked Example: Deadlines After a Provider Closure

Assume a firm's offshore provider closed on October 1, 2026. On November 2, 2026, the firm learns that a former employee of the provider still has a working login to a shared folder holding unencrypted files for 640 individual clients. The firm cannot show the files were not accessed.

The old consent is still in force but names the closed provider, so it gives no cover for sending files to a replacement. The access log and the return request belong in the incident file.

Where the Work Goes After a Shutdown: Section 7216 Routes

Where the work goes next decides whether you need new consents.

Back in-house. Returning work to your own staff is not a disclosure to another preparer, so no new consent is needed for that step.

To a US-based provider. The regulations allow a preparer to disclose tax return information "to another tax return preparer (other than an officer, employee, or member of the same tax return preparer) located in the United States" for preparing or assisting in preparing a return, "so long as the services provided are not substantive determinations or advice affecting the tax liability reported by taxpayers" (26 CFR 301.7216-2(d)). Work involving substantive determinations still requires consent.

To another offshore provider. If the new preparer "is located outside of the United States, the taxpayer's consent under § 301.7216-3 prior to any disclosure is required." For Form 1040 filers, "the consent must also identify the specific recipient (or recipients) of the tax return information," so a consent naming the closed provider does not cover the replacement. A US preparer also "may not obtain consent to disclose the taxpayer's social security number (SSN)" for Form 1040 filers to a preparer outside the United States, and must "redact or otherwise mask the taxpayer's SSN before the tax return information is disclosed" unless the regulation's exception for adequate data protection safeguards applies (26 CFR 301.7216-3). A consent that does not state its duration "will be effective for a period of one year from the date the taxpayer signed the consent."

In practice, a firm facing a mid-season shutdown often keeps tax work in-house or with a US provider until a fresh consent round is complete. Our explainer on Section 7216 consent for tax return preparers covers the consent format.

Building the Contingency Plan Before You Need It

Keep data portable. Have the outsourced team work inside your systems wherever possible. Test once a year that you can reach every client file without the provider's help.

Own the documentation. Store SOPs, client runbooks and recurring entry schedules in your firm's knowledge base, so a new team can pick them up in days.

Cross-train. Require at least two trained people on every client at the provider, and keep a reviewer on your side who knows each client's quirks.

Line up a fallback. A signed NDA and an onboarding conversation with a second provider shorten any later search.

Assess the provider on a schedule. Section 314.4(f) requires "Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards." Financial stability, staff turnover and ownership changes belong in that review alongside security. Our guide to vendor risk assessment for accounting firms sets out a review format.

Warning signs of a provider in trouble include repeated changes to your assigned team, slower replies from management and sudden requests to prepay. Several together justify a direct conversation.

Frequently Asked Questions

What happens to client data when an outsourcing provider shuts down? The data stays wherever it was stored. If your team worked in your own systems, you keep everything and only need to revoke access. If the provider held copies, you depend on its return and destruction obligations, and you should document every attempt to enforce them.

Is a provider shutdown a data breach? A closure alone is not. It becomes an FTC notification event if unencrypted customer information is acquired without authorization, and the rule presumes acquisition where there was unauthorized access unless you have reliable evidence otherwise. If at least 500 consumers are affected, notice to the FTC is due no later than 30 days after discovery.

Do I need new Section 7216 consents for a replacement provider? For an offshore replacement, yes, before any disclosure, and Form 1040 consents must name the specific recipient. A US-based preparer can assist with return preparation without consent as long as it is not making substantive determinations.

How long must I keep records the failed provider prepared? The IRS general rule is 3 years, with longer periods in some cases, and employment tax records must be kept at least 4 years after the tax is due or paid, whichever is later. The provider's closure does not shorten any of these periods.

How often should I test the contingency plan? At least once a year, outside tax season. Confirm you can reach every system without the provider and that documentation is current.

Next Step

Madras Accountancy supports US CPA firms and businesses with outsourced bookkeeping, accounting, tax preparation and CFO-level work. To talk through contingency planning for your outsourced work, contact our team.